Integrating AutoPkg and the Casper Suite. Live the Dream

Transcription

1 Integrating AutoPkg and the Casper Suite with JSSImporter Live the Dream

2 What are we Trying to Do Keep software up-to-date on client machines. Test software before deployment. Minimize IT involvement, mistakes, and time. Prioritize important software.

3 Virtuous Behavior Laziness as a virtue. Trading one kind of labor for another. The path is not easy, but it's not hard either. Creating a safe space to iterate. It's all in the reflexes.

4 How does Casper install Software? 1. Package up software (Composer) 2. Package is uploaded to distribution points. 3. Policy is created. Scoped to desired machines/ groups. 4. Targets check-in periodically, and run any queued policies. Once. (Even if it fails).

5 and when software is updated? 1. Download new version. 2. Test it out? 3. Package it up. 4. Upload it to distribution points. 5. Edit Policy to install new version. 6. Flush the logs!

6 Two Points of Pain 1. Almost all software must be repackaged. 2. Clicking on a bunch of web forms to deploy.

7 If you don't mind repetition, I have the cure...

8 Hasselhoff Infinite Recursion

9 Quality Control Our Perception Our Sad Reality *Especially in small organizations

10 Solving Point of Pain #1 AutoPkg It's a black box

11

12

13 Solving Pain #2 Take a cue from Munki and automate.

14 What does Munki do? "Munki is a set of tools that... can be used by OS X administrators to manage software installs (and in many cases removals) on OS X client machines." Manages multiple versions of software in Catalogs. Manifests gather together groupings of software to install, and Catalogs from which to pull. Clients check for updates to their available software, and install any that are available, on a schedule.

15 Development Testing Production

16 AutoPkg + Munki Already built in. Most major software already cooked up.

17 What exactly does a Munki recipe do? Extends a download or pkg recipe. Specifies metadata about product. Adds product to Catalog: (testing) Copies files to Munki repo. All of the deployment is handled elsewhere.

18 So basically it just copies software to a fileshare. Is this enough for Casper admins? i.e., what happens if you simply upload a package with Casper Admin?

19 JSSImporter & python-jss * Not the actual Allister Banks

20 Making it happen on Casper Policies should not install more than one product. Each product deployed by two policies: Testing (self service) Production (automated)

21 Deploy to Production Probably Automated Can and should be bulk created (python-jss/jss_helper) OR duplicated to remove the risk of error. Variance as Documentation: Policies should only differ in installationdependent ways. (Extra scripting, reboots, etc) Naming Convention: Install NetHack-3.4.3

22 Deploy to Testing "Official" Workflow Overview 1. Upload package to all configured distribution points. 2. Self-service policy offers new package to testing computers. 3. Test software. 4. Promote to production.

23 The Testing Group

24 Details of Self-Service Scoped to Smart Group: NetHack-update-smart Frequency: Ongoing Installs package, then recons. Client drops out of Smart Group. *No true version comparisons

25 Relax This is all you need to know. But.

26 Going Further Setting things up. Writing Recipes. Alternate Workflows. Mad Skills.

27 Installation & Configuration

28 Settings API_USERNAME & API_PASSWORD JSS_URL JSS_VERIFY_SSL JSS_REPOS

29

30 Create an API User System Settings JSS User Accounts and Groups

31 Needs Create, Read, and Update privileges for: Categories Smart Computer Groups Static Computer Groups Distribution Points (only needs "Read") Extension Attributes Packages Policies Scripts *Permissions required even if not using!

32 defaults write com.github.autopkg JSS_URL defaults write com.github.autopkg API_USERNAME <apiuser> defaults write com.github.autopkg API_PASSWORD <apipassword> defaults write com.github.autopkg JSS_VERIFY_SSL -bool <true or false>

33 Warning for Crazy Password People: Bash shell escaping and XML escaping are not the same! defaults write./test.plist Password -string bash:!": event not found Defaults will handle the XML encoding for you. Just editing the plist will not. defaults write./test.plist Password -string

34 Configuring Distribution Points (JSS_REPOS) JSS_REPOS is an array of dicts! Two kinds of distribution points settings: Automatically Configured FileShare Distribution Point JDS

35 Check the documentation for in-depth instructions on how to PlistBuddy this, OR you can edit it in your favorite text editor (which is vim)... but you probably have to plutil -convert xml1 ~/Library/Preferences/com.github.autopkg.plist first, and make sure to defaults read com.github.autopkg afterwards.

36

37

38

39 Basic Usage JSS Recipes Repo: autopkg repo-add jss-recipes autopkg search <product>

40

41 Ensure you have recipe's parent autopkg info <Recipe>

42 Run the recipe autopkg run <Product>.jss

43 What Happens First Run 1. Create categories. 2. Copy package to distribution points. 3. Create extension attributes. 4. Create static and smart groups. 5. Create scripts. 6. Create policy. 7. Attach icon to policy. Subsequent Runs 1. Update package if new. 2. Update extension attributes. 3. Update groups. 4. Update scripts 5. Update policy *Update means manual UI changes are lost: "Declarative".

44 Test Packages

45 Promote Package to Production Edit production policy: Name Manual Package Flush logs But no. jss_helper promote -u Automagical

46

47 Flush

48 Other Cool Stuff with jss_helper

49 Research Objects computer and mobile device groups computers and mobile devices policies configuration profiles (computer & md) categories imaging configurations packages

50

51 There's also: (If you're still into clicking... Remember the Hoff)

52 jss_helper installs

53 jss_helper scoped

54 Writing JSS Recipes Writing JSS recipes is primarily about applying your already-designed workflow to a new product. Workflow is described in PolicyTemplate and SmartGroupTemplate.

55 Text Substitution Autopkg and JSSImporter attempt to replace any string value wrapped in %'s with the value of a variable. E.g. %version% is replaced with Applies to recipes as well as xml templates.

56 PolicyTemplate.xml Design a policy in web UI, then edit out unnecessary elements.

57 PolicyTemplate.xml Or start with standard and edit in changes.

58 PolicyTemplate.xml Or start with standard and edit in changes.

59 SmartGroupTemplate.xml

60 Writing the JSS Recipe Copy an existing recipe, make edits, diff.

61 Writing the recipe Once Policy and SmartGroup are designed, most recipes differ only in a few ways. To reuse: Edit the description. Edit the identifier Edit the NAME Edit the SELF_SERVICE_ICON Edit the SELF_SERVICE_DESCRIPTION Edit the Category Edit the ParentRecipe

62 Standard jss-recipes Filename is <Product>.jss.recipe Identifier is com.github.jss-recipes.jss.<product>

63 Argument Doubling (*only edit the Input)

64 Extra Arguments os_requirements: x, , site_name / site_id jss_inventory_name: Microsoft OneNote vs. MSOneNote scripts extension_attributes

65 JSSRecipeCreator Takes a parent recipe as input. Will prompt for every important value OR -a for fullauto ease. JSSRecipeCreator -a ~/Library/RecipeRepos/ com.github.autopkg.sheagcraig-recipes/ OpenEmu/OpenEmu.pkg.recipe

66

67

68

69 Standard Mode prompts for: Recipe Filename Identifier NAME PolicyTemplate Package Category Policy Category Scope Self Service Icon Self Service Description

70 Overriding JSS Recipes autopkg make-override NetHack.jss Copy templates, icons to: ~/Library/AutoPkg/ RecipeOverrides/...if you want different ones. Remove things you don't need to change, edit things you do.

71

72 AppStoreApp Requires pyasn1: sudo easy_install -U pyasn1 Create a JSS Recipe for each app. Name: (App's name) ParentRecipe: com.github.nmcspadden.pkg. appstore App must be present! * Not the actual Nick McSpadden

73

74 Alternate Workflows Automatically deploy packages to testing computers. Add packages to distribution points only. Multiple JSSImporter steps create multiple policies: Install policy Notification policy Bad Idea: Use JSSImporter to automatically deploy software to all computers.

75

76 Alternate Workflows Automatically deploy packages to testing computers. Add packages to distribution points only. Multiple JSSImporter steps create multiple policies: Install policy Notification policy Bad Idea: Use JSSImporter to automatically deploy software to all computers.

77

78 Alternate Workflows Automatically deploy packages to testing computers. Add packages to distribution points only. Multiple JSSImporter steps create multiple policies: Install policy Notification policy Bad Idea: Use JSSImporter to automatically deploy software to all computers.

79 Add 2nd JSSImporter

80 NotificationPolicy

81

82 Other Stuff Automate your AutoPkg with AutoPkgr autopkgr/ LaunchDaemon and autopkg -l <my_list>

83 My JSS has 90 Google Chrome packages......and there's no room for my emergency security updates to Adobe Flash! Spruce spruce Audit unused packages, scripts. And more coming!

84

85 JSSImporter as a Management Tool Can be configured to populate: Extension attributes Example: Computer Information Fields XProtect State Scripts SavingThrow

86